PR Custody

fix(auth): rewrite localhost issuer for internal-dashboard JWTs

@Malayvasachecks n/achecks…fix/internal-dashboard-jwt-issuer-local → main3 files · +203 −6review: @shamsharoonupdated 1w ago

GitHub

▸Description · 1 noise

Summary

Local dev against staging was failing every internal-dashboard call (toolkits, logs, etc.) with 401 "Unable to verify JWT signature".

Root cause: the backend verifies dashboard-signed JWTs by fetching the JWKS from the token's iss claim. In local dev iss = NEXT_PUBLIC_APP_URL = http://localhost:3000, which the backend cannot reach — so it can never fetch our public key and rejects the signature. (Switching backend hosts doesn't help; the unreachable issuer is the problem.)

Why it's safe to rewrite: every deployed dashboard signs with the same DASHBOARD_JWT_PRIVATE_KEY — localhost:3000 and staging-dashboard.composio.dev both serve the identical key (kid 2e7193dfc1a2b0c4), and all Doppler configs share fingerprint 74eafaf2228e. So pointing the local issuer at the staging dashboard's reachable JWKS lets the backend fetch the matching key and verify successfully.

This mirrors the existing precedent in signVaultLoginJwt, which already pins a stable, reachable issuer (connect.composio.dev).

Changes

resolveDashboardJwtIssuer() in dashboard-keys.ts rewrites localhost app URLs (localhost / 127.0.0.1 / [::1]) to https://staging-dashboard.composio.dev; deployed URLs pass through unchanged.
Applied inside signInternalDashboardJwt, so both the internal-dashboard client and the auth-callback resolve_user path are covered.
getDashboardJwtKeyDebugInfo().jwksUrl now reports the resolved (reachable) issuer.
Expanded internal-dashboard logs in local dev + added JWT/JWKS auth diagnostics (INTERNAL_DASHBOARD_DEBUG=1 for full payloads) so signature mismatches are visible without extra setup.

Test plan

tsgo typecheck passes on changed files
oxlint passes on changed files
resolveDashboardJwtIssuer mapping verified (localhost variants → staging dashboard; deployed URLs unchanged)
Run pnpm dev against staging and confirm toolkits.listToolkits / logs.pollActionLogs return 200 instead of 401

Notes

The @prisma/client Turbopack export * warning seen alongside these logs is unrelated CommonJS-bundling noise and is not addressed here.

Made with Cursor

▸ 1 bot/status comment hidden

@vercel[bot]1w ago

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dashboard	Ready	Preview, Comment	Jun 5, 2026 2:27am

loading diff…